FROM python:3.11-slim

# Set environment variables
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    APP_DIR=/app \
    DATA_DIR=/data \
    BACKUP_DIR=/backups \
    PORT=8888 \
    HOST=0.0.0.0

# Install required system packages:
# - openssh-client: ssh, scp, ssh-keygen
# - sshpass: password-based SSH authentication
# - rsync: efficient file staging and transfers
# - tar & gzip: archive inspection, creation, and extraction
# - curl & ca-certificates: healthchecks and outbound webhooks
# - procps: psutil and process management
# - sqlite3: SQLite verification
# - gosu: PUID/PGID privilege handling for Unraid / Docker hosts
RUN apt-get update && apt-get install -y --no-install-recommends \
    openssh-client \
    sshpass \
    rsync \
    tar \
    gzip \
    curl \
    ca-certificates \
    procps \
    sqlite3 \
    gosu \
    bash \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy dependency specifications first for Docker layer caching
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application source code and scripts
COPY backend/ ./backend/
COPY frontend/ ./frontend/
COPY entrypoint.sh .

# Ensure entrypoint is executable and mount points exist
RUN chmod +x /app/entrypoint.sh && \
    mkdir -p /data /backups

# Expose Sentinel Web Dashboard port
EXPOSE 8888

# Persistent volumes for application configuration and backup archives
VOLUME ["/data", "/backups"]

# Health check to monitor dashboard responsiveness
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:8888/api/auth/status || exit 1

ENTRYPOINT ["/app/entrypoint.sh"]

CMD ["python", "-m", "uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "8888"]